Can Username and Password be passed to WP Login page in an IFrame?

Question

I am using a real estate commercial theme, that uses a custom login/registration from on the frontend.

The admin panel and option pages are restricted to Administrators, but if the theme is deactivated, non-Admins can visit the admin panel and see the setup options for listing authors.

When the theme is active, Authors only see the front end of the site with the front end login.

I have embedded an iframe using another popular WP plugin into the User Front End form.

In the IFrame the WP login can be accessed that would lead to the core WP Admin screen where the plugin is seen and is available for Users with Author roles.

But I need for this WP Admin view to open with the same Username and Password as the Front End.

What is the best way of passing the User's Front End login credentials back to the core WP Admin inside the IFrame?

So that when the IFrame calls up wp-admin/ or wp-admin/plugins.php that it will display the same core wp-admin view as if the real estate theme had not been installed?

Neither the custom real estate developer nor the IFrame plugin developer have an answer for this situation.

Answer 1

Loading the admin panel in the browser, and loading the admin panel inside an iframe are the same thing. You can't block one without blocking the other unless you differentiate them somehow.

You would need to make the code that stops users accessing the admin panel look for some identifier, e.g.:

if the URL has iframe=true in the url
    don't restrict the admin panel

The specifics of how to do this are dependent on the code in the theme that restricts admins.

But this will then have the problem that any URLs clicked inside the iframe will be restricted too, along with admin AJAX, but that depends on how your admin restriction code works

My recommendation is not to bother. To do this properly you'll also need to ask the following questions:

• How do I hide the admin toolbar?
• How do I hide the admin menu?
• How do I grant plugin activation/deactivation privileges to authors?

Instead, I recommend you ask those 2 questions, and instead do the following:

• Set your settings pages to require admin privileges, this way authors won't be able to see them when logged into the backend
• Remove the other pages from the admin menu

All of which have been asked by others on this site.

One final note, themes are for visuals/presentation, not functionality. You should take the admin restriction code and move it into its own plugin. This way the admin is restricted even when the theme is deactivated